xref: /linux-6.15/drivers/usb/gadget/function/f_tcm.c (revision 5cf091d5)
1 // SPDX-License-Identifier: GPL-2.0
2 /* Target based USB-Gadget
3  *
4  * UAS protocol handling, target callbacks, configfs handling,
5  * BBB (USB Mass Storage Class Bulk-Only (BBB) and Transport protocol handling.
6  *
7  * Author: Sebastian Andrzej Siewior <bigeasy at linutronix dot de>
8  */
9 #include <linux/kernel.h>
10 #include <linux/module.h>
11 #include <linux/types.h>
12 #include <linux/string.h>
13 #include <linux/configfs.h>
14 #include <linux/ctype.h>
15 #include <linux/usb/ch9.h>
16 #include <linux/usb/composite.h>
17 #include <linux/usb/gadget.h>
18 #include <linux/usb/storage.h>
19 #include <scsi/scsi_tcq.h>
20 #include <target/target_core_base.h>
21 #include <target/target_core_fabric.h>
22 #include <linux/unaligned.h>
23 
24 #include "tcm.h"
25 #include "u_tcm.h"
26 #include "configfs.h"
27 
28 #define TPG_INSTANCES		1
29 
30 struct tpg_instance {
31 	struct usb_function_instance	*func_inst;
32 	struct usbg_tpg			*tpg;
33 };
34 
35 static struct tpg_instance tpg_instances[TPG_INSTANCES];
36 
37 static DEFINE_MUTEX(tpg_instances_lock);
38 
39 static inline struct f_uas *to_f_uas(struct usb_function *f)
40 {
41 	return container_of(f, struct f_uas, function);
42 }
43 
44 /* Start bot.c code */
45 
46 static int bot_enqueue_cmd_cbw(struct f_uas *fu)
47 {
48 	int ret;
49 
50 	if (fu->flags & USBG_BOT_CMD_PEND)
51 		return 0;
52 
53 	ret = usb_ep_queue(fu->ep_out, fu->cmd[0].req, GFP_ATOMIC);
54 	if (!ret)
55 		fu->flags |= USBG_BOT_CMD_PEND;
56 	return ret;
57 }
58 
59 static void bot_status_complete(struct usb_ep *ep, struct usb_request *req)
60 {
61 	struct usbg_cmd *cmd = req->context;
62 	struct f_uas *fu = cmd->fu;
63 
64 	transport_generic_free_cmd(&cmd->se_cmd, 0);
65 	if (req->status < 0) {
66 		pr_err("ERR %s(%d)\n", __func__, __LINE__);
67 		return;
68 	}
69 
70 	/* CSW completed, wait for next CBW */
71 	bot_enqueue_cmd_cbw(fu);
72 }
73 
74 static void bot_enqueue_sense_code(struct f_uas *fu, struct usbg_cmd *cmd)
75 {
76 	struct bulk_cs_wrap *csw = &fu->bot_status.csw;
77 	int ret;
78 	unsigned int csw_stat;
79 
80 	csw_stat = cmd->csw_code;
81 	csw->Tag = cmd->bot_tag;
82 	csw->Status = csw_stat;
83 	fu->bot_status.req->context = cmd;
84 	ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_ATOMIC);
85 	if (ret)
86 		pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
87 }
88 
89 static void bot_err_compl(struct usb_ep *ep, struct usb_request *req)
90 {
91 	struct usbg_cmd *cmd = req->context;
92 	struct f_uas *fu = cmd->fu;
93 
94 	if (req->status < 0)
95 		pr_err("ERR %s(%d)\n", __func__, __LINE__);
96 
97 	if (cmd->data_len) {
98 		if (cmd->data_len > ep->maxpacket) {
99 			req->length = ep->maxpacket;
100 			cmd->data_len -= ep->maxpacket;
101 		} else {
102 			req->length = cmd->data_len;
103 			cmd->data_len = 0;
104 		}
105 
106 		usb_ep_queue(ep, req, GFP_ATOMIC);
107 		return;
108 	}
109 	bot_enqueue_sense_code(fu, cmd);
110 }
111 
112 static void bot_send_bad_status(struct usbg_cmd *cmd)
113 {
114 	struct f_uas *fu = cmd->fu;
115 	struct bulk_cs_wrap *csw = &fu->bot_status.csw;
116 	struct usb_request *req;
117 	struct usb_ep *ep;
118 
119 	csw->Residue = cpu_to_le32(cmd->data_len);
120 
121 	if (cmd->data_len) {
122 		if (cmd->is_read) {
123 			ep = fu->ep_in;
124 			req = fu->bot_req_in;
125 		} else {
126 			ep = fu->ep_out;
127 			req = fu->bot_req_out;
128 		}
129 
130 		if (cmd->data_len > fu->ep_in->maxpacket) {
131 			req->length = ep->maxpacket;
132 			cmd->data_len -= ep->maxpacket;
133 		} else {
134 			req->length = cmd->data_len;
135 			cmd->data_len = 0;
136 		}
137 		req->complete = bot_err_compl;
138 		req->context = cmd;
139 		req->buf = fu->cmd[0].buf;
140 		usb_ep_queue(ep, req, GFP_KERNEL);
141 	} else {
142 		bot_enqueue_sense_code(fu, cmd);
143 	}
144 }
145 
146 static int bot_send_status(struct usbg_cmd *cmd, bool moved_data)
147 {
148 	struct f_uas *fu = cmd->fu;
149 	struct bulk_cs_wrap *csw = &fu->bot_status.csw;
150 	int ret;
151 
152 	if (cmd->se_cmd.scsi_status == SAM_STAT_GOOD) {
153 		if (!moved_data && cmd->data_len) {
154 			/*
155 			 * the host wants to move data, we don't. Fill / empty
156 			 * the pipe and then send the csw with reside set.
157 			 */
158 			cmd->csw_code = US_BULK_STAT_OK;
159 			bot_send_bad_status(cmd);
160 			return 0;
161 		}
162 
163 		csw->Tag = cmd->bot_tag;
164 		csw->Residue = cpu_to_le32(0);
165 		csw->Status = US_BULK_STAT_OK;
166 		fu->bot_status.req->context = cmd;
167 
168 		ret = usb_ep_queue(fu->ep_in, fu->bot_status.req, GFP_KERNEL);
169 		if (ret)
170 			pr_err("%s(%d) ERR: %d\n", __func__, __LINE__, ret);
171 	} else {
172 		cmd->csw_code = US_BULK_STAT_FAIL;
173 		bot_send_bad_status(cmd);
174 	}
175 	return 0;
176 }
177 
178 /*
179  * Called after command (no data transfer) or after the write (to device)
180  * operation is completed
181  */
182 static int bot_send_status_response(struct usbg_cmd *cmd)
183 {
184 	bool moved_data = false;
185 
186 	if (!cmd->is_read)
187 		moved_data = true;
188 	return bot_send_status(cmd, moved_data);
189 }
190 
191 /* Read request completed, now we have to send the CSW */
192 static void bot_read_compl(struct usb_ep *ep, struct usb_request *req)
193 {
194 	struct usbg_cmd *cmd = req->context;
195 
196 	if (req->status < 0)
197 		pr_err("ERR %s(%d)\n", __func__, __LINE__);
198 
199 	bot_send_status(cmd, true);
200 }
201 
202 static int bot_send_read_response(struct usbg_cmd *cmd)
203 {
204 	struct f_uas *fu = cmd->fu;
205 	struct se_cmd *se_cmd = &cmd->se_cmd;
206 	struct usb_gadget *gadget = fuas_to_gadget(fu);
207 	int ret;
208 
209 	if (!cmd->data_len) {
210 		cmd->csw_code = US_BULK_STAT_PHASE;
211 		bot_send_bad_status(cmd);
212 		return 0;
213 	}
214 
215 	if (!gadget->sg_supported) {
216 		cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
217 		if (!cmd->data_buf)
218 			return -ENOMEM;
219 
220 		sg_copy_to_buffer(se_cmd->t_data_sg,
221 				se_cmd->t_data_nents,
222 				cmd->data_buf,
223 				se_cmd->data_length);
224 
225 		fu->bot_req_in->buf = cmd->data_buf;
226 	} else {
227 		fu->bot_req_in->buf = NULL;
228 		fu->bot_req_in->num_sgs = se_cmd->t_data_nents;
229 		fu->bot_req_in->sg = se_cmd->t_data_sg;
230 	}
231 
232 	fu->bot_req_in->complete = bot_read_compl;
233 	fu->bot_req_in->length = se_cmd->data_length;
234 	fu->bot_req_in->context = cmd;
235 	ret = usb_ep_queue(fu->ep_in, fu->bot_req_in, GFP_ATOMIC);
236 	if (ret)
237 		pr_err("%s(%d)\n", __func__, __LINE__);
238 	return 0;
239 }
240 
241 static void usbg_data_write_cmpl(struct usb_ep *, struct usb_request *);
242 static int usbg_prepare_w_request(struct usbg_cmd *, struct usb_request *);
243 
244 static int bot_send_write_request(struct usbg_cmd *cmd)
245 {
246 	struct f_uas *fu = cmd->fu;
247 	struct se_cmd *se_cmd = &cmd->se_cmd;
248 	int ret;
249 
250 	init_completion(&cmd->write_complete);
251 	cmd->fu = fu;
252 
253 	if (!cmd->data_len) {
254 		cmd->csw_code = US_BULK_STAT_PHASE;
255 		return -EINVAL;
256 	}
257 
258 	ret = usbg_prepare_w_request(cmd, fu->bot_req_out);
259 	if (ret)
260 		goto cleanup;
261 	ret = usb_ep_queue(fu->ep_out, fu->bot_req_out, GFP_KERNEL);
262 	if (ret)
263 		pr_err("%s(%d)\n", __func__, __LINE__);
264 
265 	wait_for_completion(&cmd->write_complete);
266 	target_execute_cmd(se_cmd);
267 cleanup:
268 	return ret;
269 }
270 
271 static int bot_submit_command(struct f_uas *, void *, unsigned int);
272 
273 static void bot_cmd_complete(struct usb_ep *ep, struct usb_request *req)
274 {
275 	struct f_uas *fu = req->context;
276 	int ret;
277 
278 	fu->flags &= ~USBG_BOT_CMD_PEND;
279 
280 	if (req->status < 0)
281 		return;
282 
283 	ret = bot_submit_command(fu, req->buf, req->actual);
284 	if (ret)
285 		pr_err("%s(%d): %d\n", __func__, __LINE__, ret);
286 }
287 
288 static int bot_prepare_reqs(struct f_uas *fu)
289 {
290 	int ret;
291 
292 	fu->bot_req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
293 	if (!fu->bot_req_in)
294 		goto err;
295 
296 	fu->bot_req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
297 	if (!fu->bot_req_out)
298 		goto err_out;
299 
300 	fu->cmd[0].req = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
301 	if (!fu->cmd[0].req)
302 		goto err_cmd;
303 
304 	fu->bot_status.req = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
305 	if (!fu->bot_status.req)
306 		goto err_sts;
307 
308 	fu->bot_status.req->buf = &fu->bot_status.csw;
309 	fu->bot_status.req->length = US_BULK_CS_WRAP_LEN;
310 	fu->bot_status.req->complete = bot_status_complete;
311 	fu->bot_status.csw.Signature = cpu_to_le32(US_BULK_CS_SIGN);
312 
313 	fu->cmd[0].buf = kmalloc(fu->ep_out->maxpacket, GFP_KERNEL);
314 	if (!fu->cmd[0].buf)
315 		goto err_buf;
316 
317 	fu->cmd[0].req->complete = bot_cmd_complete;
318 	fu->cmd[0].req->buf = fu->cmd[0].buf;
319 	fu->cmd[0].req->length = fu->ep_out->maxpacket;
320 	fu->cmd[0].req->context = fu;
321 
322 	ret = bot_enqueue_cmd_cbw(fu);
323 	if (ret)
324 		goto err_queue;
325 	return 0;
326 err_queue:
327 	kfree(fu->cmd[0].buf);
328 	fu->cmd[0].buf = NULL;
329 err_buf:
330 	usb_ep_free_request(fu->ep_in, fu->bot_status.req);
331 err_sts:
332 	usb_ep_free_request(fu->ep_out, fu->cmd[0].req);
333 	fu->cmd[0].req = NULL;
334 err_cmd:
335 	usb_ep_free_request(fu->ep_out, fu->bot_req_out);
336 	fu->bot_req_out = NULL;
337 err_out:
338 	usb_ep_free_request(fu->ep_in, fu->bot_req_in);
339 	fu->bot_req_in = NULL;
340 err:
341 	pr_err("BOT: endpoint setup failed\n");
342 	return -ENOMEM;
343 }
344 
345 static void bot_cleanup_old_alt(struct f_uas *fu)
346 {
347 	if (!(fu->flags & USBG_ENABLED))
348 		return;
349 
350 	usb_ep_disable(fu->ep_in);
351 	usb_ep_disable(fu->ep_out);
352 
353 	if (!fu->bot_req_in)
354 		return;
355 
356 	usb_ep_free_request(fu->ep_in, fu->bot_req_in);
357 	usb_ep_free_request(fu->ep_out, fu->bot_req_out);
358 	usb_ep_free_request(fu->ep_out, fu->cmd[0].req);
359 	usb_ep_free_request(fu->ep_in, fu->bot_status.req);
360 
361 	kfree(fu->cmd[0].buf);
362 
363 	fu->bot_req_in = NULL;
364 	fu->bot_req_out = NULL;
365 	fu->cmd[0].req = NULL;
366 	fu->bot_status.req = NULL;
367 	fu->cmd[0].buf = NULL;
368 }
369 
370 static void bot_set_alt(struct f_uas *fu)
371 {
372 	struct usb_function *f = &fu->function;
373 	struct usb_gadget *gadget = f->config->cdev->gadget;
374 	int ret;
375 
376 	fu->flags = USBG_IS_BOT;
377 
378 	config_ep_by_speed_and_alt(gadget, f, fu->ep_in, USB_G_ALT_INT_BBB);
379 	ret = usb_ep_enable(fu->ep_in);
380 	if (ret)
381 		goto err_b_in;
382 
383 	config_ep_by_speed_and_alt(gadget, f, fu->ep_out, USB_G_ALT_INT_BBB);
384 	ret = usb_ep_enable(fu->ep_out);
385 	if (ret)
386 		goto err_b_out;
387 
388 	ret = bot_prepare_reqs(fu);
389 	if (ret)
390 		goto err_wq;
391 	fu->flags |= USBG_ENABLED;
392 	pr_info("Using the BOT protocol\n");
393 	return;
394 err_wq:
395 	usb_ep_disable(fu->ep_out);
396 err_b_out:
397 	usb_ep_disable(fu->ep_in);
398 err_b_in:
399 	fu->flags = USBG_IS_BOT;
400 }
401 
402 static int usbg_bot_setup(struct usb_function *f,
403 		const struct usb_ctrlrequest *ctrl)
404 {
405 	struct f_uas *fu = to_f_uas(f);
406 	struct usb_composite_dev *cdev = f->config->cdev;
407 	u16 w_value = le16_to_cpu(ctrl->wValue);
408 	u16 w_length = le16_to_cpu(ctrl->wLength);
409 	int luns;
410 	u8 *ret_lun;
411 
412 	switch (ctrl->bRequest) {
413 	case US_BULK_GET_MAX_LUN:
414 		if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_CLASS |
415 					USB_RECIP_INTERFACE))
416 			return -ENOTSUPP;
417 
418 		if (w_length < 1)
419 			return -EINVAL;
420 		if (w_value != 0)
421 			return -EINVAL;
422 		luns = atomic_read(&fu->tpg->tpg_port_count);
423 		if (!luns) {
424 			pr_err("No LUNs configured?\n");
425 			return -EINVAL;
426 		}
427 		luns--;
428 		if (luns > US_BULK_MAX_LUN_LIMIT) {
429 			pr_info_once("Limiting the number of luns to 16\n");
430 			luns = US_BULK_MAX_LUN_LIMIT;
431 		}
432 		ret_lun = cdev->req->buf;
433 		*ret_lun = luns;
434 		cdev->req->length = 1;
435 		return usb_ep_queue(cdev->gadget->ep0, cdev->req, GFP_ATOMIC);
436 
437 	case US_BULK_RESET_REQUEST:
438 		/* XXX maybe we should remove previous requests for IN + OUT */
439 		bot_enqueue_cmd_cbw(fu);
440 		return 0;
441 	}
442 	return -ENOTSUPP;
443 }
444 
445 /* Start uas.c code */
446 
447 static void uasp_cleanup_one_stream(struct f_uas *fu, struct uas_stream *stream)
448 {
449 	/* We have either all three allocated or none */
450 	if (!stream->req_in)
451 		return;
452 
453 	usb_ep_free_request(fu->ep_in, stream->req_in);
454 	usb_ep_free_request(fu->ep_out, stream->req_out);
455 	usb_ep_free_request(fu->ep_status, stream->req_status);
456 
457 	stream->req_in = NULL;
458 	stream->req_out = NULL;
459 	stream->req_status = NULL;
460 }
461 
462 static void uasp_free_cmdreq(struct f_uas *fu)
463 {
464 	int i;
465 
466 	for (i = 0; i < USBG_NUM_CMDS; i++) {
467 		usb_ep_free_request(fu->ep_cmd, fu->cmd[i].req);
468 		kfree(fu->cmd[i].buf);
469 		fu->cmd[i].req = NULL;
470 		fu->cmd[i].buf = NULL;
471 	}
472 }
473 
474 static void uasp_cleanup_old_alt(struct f_uas *fu)
475 {
476 	int i;
477 
478 	if (!(fu->flags & USBG_ENABLED))
479 		return;
480 
481 	usb_ep_disable(fu->ep_in);
482 	usb_ep_disable(fu->ep_out);
483 	usb_ep_disable(fu->ep_status);
484 	usb_ep_disable(fu->ep_cmd);
485 
486 	for (i = 0; i < USBG_NUM_CMDS; i++)
487 		uasp_cleanup_one_stream(fu, &fu->stream[i]);
488 	uasp_free_cmdreq(fu);
489 }
490 
491 static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req);
492 
493 static int uasp_prepare_r_request(struct usbg_cmd *cmd)
494 {
495 	struct se_cmd *se_cmd = &cmd->se_cmd;
496 	struct f_uas *fu = cmd->fu;
497 	struct usb_gadget *gadget = fuas_to_gadget(fu);
498 	struct uas_stream *stream = &fu->stream[se_cmd->map_tag];
499 
500 	if (!gadget->sg_supported) {
501 		cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
502 		if (!cmd->data_buf)
503 			return -ENOMEM;
504 
505 		sg_copy_to_buffer(se_cmd->t_data_sg,
506 				se_cmd->t_data_nents,
507 				cmd->data_buf,
508 				se_cmd->data_length);
509 
510 		stream->req_in->buf = cmd->data_buf;
511 	} else {
512 		stream->req_in->buf = NULL;
513 		stream->req_in->num_sgs = se_cmd->t_data_nents;
514 		stream->req_in->sg = se_cmd->t_data_sg;
515 	}
516 
517 	stream->req_in->is_last = 1;
518 	stream->req_in->stream_id = cmd->tag;
519 	stream->req_in->complete = uasp_status_data_cmpl;
520 	stream->req_in->length = se_cmd->data_length;
521 	stream->req_in->context = cmd;
522 
523 	cmd->state = UASP_SEND_STATUS;
524 	return 0;
525 }
526 
527 static void uasp_prepare_status(struct usbg_cmd *cmd)
528 {
529 	struct se_cmd *se_cmd = &cmd->se_cmd;
530 	struct sense_iu *iu = &cmd->sense_iu;
531 	struct uas_stream *stream = &cmd->fu->stream[se_cmd->map_tag];
532 
533 	cmd->state = UASP_QUEUE_COMMAND;
534 	iu->iu_id = IU_ID_STATUS;
535 	iu->tag = cpu_to_be16(cmd->tag);
536 
537 	/*
538 	 * iu->status_qual = cpu_to_be16(STATUS QUALIFIER SAM-4. Where R U?);
539 	 */
540 	iu->len = cpu_to_be16(se_cmd->scsi_sense_length);
541 	iu->status = se_cmd->scsi_status;
542 	stream->req_status->is_last = 1;
543 	stream->req_status->stream_id = cmd->tag;
544 	stream->req_status->context = cmd;
545 	stream->req_status->length = se_cmd->scsi_sense_length + 16;
546 	stream->req_status->buf = iu;
547 	stream->req_status->complete = uasp_status_data_cmpl;
548 }
549 
550 static void uasp_status_data_cmpl(struct usb_ep *ep, struct usb_request *req)
551 {
552 	struct usbg_cmd *cmd = req->context;
553 	struct f_uas *fu = cmd->fu;
554 	struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
555 	int ret;
556 
557 	if (req->status < 0)
558 		goto cleanup;
559 
560 	switch (cmd->state) {
561 	case UASP_SEND_DATA:
562 		ret = uasp_prepare_r_request(cmd);
563 		if (ret)
564 			goto cleanup;
565 		ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
566 		if (ret)
567 			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
568 		break;
569 
570 	case UASP_RECEIVE_DATA:
571 		ret = usbg_prepare_w_request(cmd, stream->req_out);
572 		if (ret)
573 			goto cleanup;
574 		ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
575 		if (ret)
576 			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
577 		break;
578 
579 	case UASP_SEND_STATUS:
580 		uasp_prepare_status(cmd);
581 		ret = usb_ep_queue(fu->ep_status, stream->req_status,
582 				GFP_ATOMIC);
583 		if (ret)
584 			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
585 		break;
586 
587 	case UASP_QUEUE_COMMAND:
588 		transport_generic_free_cmd(&cmd->se_cmd, 0);
589 		usb_ep_queue(fu->ep_cmd, cmd->req, GFP_ATOMIC);
590 
591 		break;
592 
593 	default:
594 		BUG();
595 	}
596 	return;
597 
598 cleanup:
599 	transport_generic_free_cmd(&cmd->se_cmd, 0);
600 }
601 
602 static int uasp_send_status_response(struct usbg_cmd *cmd)
603 {
604 	struct f_uas *fu = cmd->fu;
605 	struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
606 	struct sense_iu *iu = &cmd->sense_iu;
607 
608 	iu->tag = cpu_to_be16(cmd->tag);
609 	stream->req_status->complete = uasp_status_data_cmpl;
610 	stream->req_status->context = cmd;
611 	cmd->fu = fu;
612 	uasp_prepare_status(cmd);
613 	return usb_ep_queue(fu->ep_status, stream->req_status, GFP_ATOMIC);
614 }
615 
616 static int uasp_send_read_response(struct usbg_cmd *cmd)
617 {
618 	struct f_uas *fu = cmd->fu;
619 	struct uas_stream *stream = &fu->stream[cmd->se_cmd.map_tag];
620 	struct sense_iu *iu = &cmd->sense_iu;
621 	int ret;
622 
623 	cmd->fu = fu;
624 
625 	iu->tag = cpu_to_be16(cmd->tag);
626 	if (fu->flags & USBG_USE_STREAMS) {
627 
628 		ret = uasp_prepare_r_request(cmd);
629 		if (ret)
630 			goto out;
631 		ret = usb_ep_queue(fu->ep_in, stream->req_in, GFP_ATOMIC);
632 		if (ret) {
633 			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
634 			kfree(cmd->data_buf);
635 			cmd->data_buf = NULL;
636 		}
637 
638 	} else {
639 
640 		iu->iu_id = IU_ID_READ_READY;
641 		iu->tag = cpu_to_be16(cmd->tag);
642 
643 		stream->req_status->complete = uasp_status_data_cmpl;
644 		stream->req_status->context = cmd;
645 
646 		cmd->state = UASP_SEND_DATA;
647 		stream->req_status->buf = iu;
648 		stream->req_status->length = sizeof(struct iu);
649 
650 		ret = usb_ep_queue(fu->ep_status, stream->req_status,
651 				GFP_ATOMIC);
652 		if (ret)
653 			pr_err("%s(%d) => %d\n", __func__, __LINE__, ret);
654 	}
655 out:
656 	return ret;
657 }
658 
659 static int uasp_send_write_request(struct usbg_cmd *cmd)
660 {
661 	struct f_uas *fu = cmd->fu;
662 	struct se_cmd *se_cmd = &cmd->se_cmd;
663 	struct uas_stream *stream = &fu->stream[se_cmd->map_tag];
664 	struct sense_iu *iu = &cmd->sense_iu;
665 	int ret;
666 
667 	init_completion(&cmd->write_complete);
668 	cmd->fu = fu;
669 
670 	iu->tag = cpu_to_be16(cmd->tag);
671 
672 	if (fu->flags & USBG_USE_STREAMS) {
673 
674 		ret = usbg_prepare_w_request(cmd, stream->req_out);
675 		if (ret)
676 			goto cleanup;
677 		ret = usb_ep_queue(fu->ep_out, stream->req_out, GFP_ATOMIC);
678 		if (ret)
679 			pr_err("%s(%d)\n", __func__, __LINE__);
680 
681 	} else {
682 
683 		iu->iu_id = IU_ID_WRITE_READY;
684 		iu->tag = cpu_to_be16(cmd->tag);
685 
686 		stream->req_status->complete = uasp_status_data_cmpl;
687 		stream->req_status->context = cmd;
688 
689 		cmd->state = UASP_RECEIVE_DATA;
690 		stream->req_status->buf = iu;
691 		stream->req_status->length = sizeof(struct iu);
692 
693 		ret = usb_ep_queue(fu->ep_status, stream->req_status,
694 				GFP_ATOMIC);
695 		if (ret)
696 			pr_err("%s(%d)\n", __func__, __LINE__);
697 	}
698 
699 	wait_for_completion(&cmd->write_complete);
700 	target_execute_cmd(se_cmd);
701 cleanup:
702 	return ret;
703 }
704 
705 static int usbg_submit_command(struct f_uas *, struct usb_request *);
706 
707 static void uasp_cmd_complete(struct usb_ep *ep, struct usb_request *req)
708 {
709 	struct f_uas *fu = req->context;
710 
711 	if (req->status == -ESHUTDOWN)
712 		return;
713 
714 	if (req->status < 0) {
715 		usb_ep_queue(fu->ep_cmd, req, GFP_ATOMIC);
716 		return;
717 	}
718 
719 	usbg_submit_command(fu, req);
720 }
721 
722 static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
723 {
724 	stream->req_in = usb_ep_alloc_request(fu->ep_in, GFP_KERNEL);
725 	if (!stream->req_in)
726 		goto out;
727 
728 	stream->req_out = usb_ep_alloc_request(fu->ep_out, GFP_KERNEL);
729 	if (!stream->req_out)
730 		goto err_out;
731 
732 	stream->req_status = usb_ep_alloc_request(fu->ep_status, GFP_KERNEL);
733 	if (!stream->req_status)
734 		goto err_sts;
735 
736 	return 0;
737 
738 err_sts:
739 	usb_ep_free_request(fu->ep_out, stream->req_out);
740 	stream->req_out = NULL;
741 err_out:
742 	usb_ep_free_request(fu->ep_in, stream->req_in);
743 	stream->req_in = NULL;
744 out:
745 	return -ENOMEM;
746 }
747 
748 static int uasp_alloc_cmd(struct f_uas *fu, int i)
749 {
750 	fu->cmd[i].req = usb_ep_alloc_request(fu->ep_cmd, GFP_KERNEL);
751 	if (!fu->cmd[i].req)
752 		goto err;
753 
754 	fu->cmd[i].buf = kmalloc(fu->ep_cmd->maxpacket, GFP_KERNEL);
755 	if (!fu->cmd[i].buf)
756 		goto err_buf;
757 
758 	fu->cmd[i].req->complete = uasp_cmd_complete;
759 	fu->cmd[i].req->buf = fu->cmd[i].buf;
760 	fu->cmd[i].req->length = fu->ep_cmd->maxpacket;
761 	fu->cmd[i].req->context = fu;
762 	return 0;
763 
764 err_buf:
765 	usb_ep_free_request(fu->ep_cmd, fu->cmd[i].req);
766 err:
767 	return -ENOMEM;
768 }
769 
770 static int uasp_prepare_reqs(struct f_uas *fu)
771 {
772 	int ret;
773 	int i;
774 
775 	for (i = 0; i < USBG_NUM_CMDS; i++) {
776 		ret = uasp_alloc_stream_res(fu, &fu->stream[i]);
777 		if (ret)
778 			goto err_cleanup;
779 	}
780 
781 	for (i = 0; i < USBG_NUM_CMDS; i++) {
782 		ret = uasp_alloc_cmd(fu, i);
783 		if (ret)
784 			goto err_free_stream;
785 
786 		ret = usb_ep_queue(fu->ep_cmd, fu->cmd[i].req, GFP_ATOMIC);
787 		if (ret)
788 			goto err_free_stream;
789 	}
790 
791 	return 0;
792 
793 err_free_stream:
794 	uasp_free_cmdreq(fu);
795 
796 err_cleanup:
797 	if (i) {
798 		do {
799 			uasp_cleanup_one_stream(fu, &fu->stream[i - 1]);
800 			i--;
801 		} while (i);
802 	}
803 	pr_err("UASP: endpoint setup failed\n");
804 	return ret;
805 }
806 
807 static void uasp_set_alt(struct f_uas *fu)
808 {
809 	struct usb_function *f = &fu->function;
810 	struct usb_gadget *gadget = f->config->cdev->gadget;
811 	int ret;
812 
813 	fu->flags = USBG_IS_UAS;
814 
815 	if (gadget->speed >= USB_SPEED_SUPER)
816 		fu->flags |= USBG_USE_STREAMS;
817 
818 	config_ep_by_speed_and_alt(gadget, f, fu->ep_in, USB_G_ALT_INT_UAS);
819 	ret = usb_ep_enable(fu->ep_in);
820 	if (ret)
821 		goto err_b_in;
822 
823 	config_ep_by_speed_and_alt(gadget, f, fu->ep_out, USB_G_ALT_INT_UAS);
824 	ret = usb_ep_enable(fu->ep_out);
825 	if (ret)
826 		goto err_b_out;
827 
828 	config_ep_by_speed_and_alt(gadget, f, fu->ep_cmd, USB_G_ALT_INT_UAS);
829 	ret = usb_ep_enable(fu->ep_cmd);
830 	if (ret)
831 		goto err_cmd;
832 	config_ep_by_speed_and_alt(gadget, f, fu->ep_status, USB_G_ALT_INT_UAS);
833 	ret = usb_ep_enable(fu->ep_status);
834 	if (ret)
835 		goto err_status;
836 
837 	ret = uasp_prepare_reqs(fu);
838 	if (ret)
839 		goto err_wq;
840 	fu->flags |= USBG_ENABLED;
841 
842 	pr_info("Using the UAS protocol\n");
843 	return;
844 err_wq:
845 	usb_ep_disable(fu->ep_status);
846 err_status:
847 	usb_ep_disable(fu->ep_cmd);
848 err_cmd:
849 	usb_ep_disable(fu->ep_out);
850 err_b_out:
851 	usb_ep_disable(fu->ep_in);
852 err_b_in:
853 	fu->flags = 0;
854 }
855 
856 static int get_cmd_dir(const unsigned char *cdb)
857 {
858 	int ret;
859 
860 	switch (cdb[0]) {
861 	case READ_6:
862 	case READ_10:
863 	case READ_12:
864 	case READ_16:
865 	case INQUIRY:
866 	case MODE_SENSE:
867 	case MODE_SENSE_10:
868 	case SERVICE_ACTION_IN_16:
869 	case MAINTENANCE_IN:
870 	case PERSISTENT_RESERVE_IN:
871 	case SECURITY_PROTOCOL_IN:
872 	case ACCESS_CONTROL_IN:
873 	case REPORT_LUNS:
874 	case READ_BLOCK_LIMITS:
875 	case READ_POSITION:
876 	case READ_CAPACITY:
877 	case READ_TOC:
878 	case READ_FORMAT_CAPACITIES:
879 	case REQUEST_SENSE:
880 	case ATA_12:
881 	case ATA_16:
882 		ret = DMA_FROM_DEVICE;
883 		break;
884 
885 	case WRITE_6:
886 	case WRITE_10:
887 	case WRITE_12:
888 	case WRITE_16:
889 	case MODE_SELECT:
890 	case MODE_SELECT_10:
891 	case WRITE_VERIFY:
892 	case WRITE_VERIFY_12:
893 	case PERSISTENT_RESERVE_OUT:
894 	case MAINTENANCE_OUT:
895 	case SECURITY_PROTOCOL_OUT:
896 	case ACCESS_CONTROL_OUT:
897 		ret = DMA_TO_DEVICE;
898 		break;
899 	case ALLOW_MEDIUM_REMOVAL:
900 	case TEST_UNIT_READY:
901 	case SYNCHRONIZE_CACHE:
902 	case START_STOP:
903 	case ERASE:
904 	case REZERO_UNIT:
905 	case SEEK_10:
906 	case SPACE:
907 	case VERIFY:
908 	case WRITE_FILEMARKS:
909 		ret = DMA_NONE;
910 		break;
911 	default:
912 #define CMD_DIR_MSG "target: Unknown data direction for SCSI Opcode 0x%02x\n"
913 		pr_warn(CMD_DIR_MSG, cdb[0]);
914 #undef CMD_DIR_MSG
915 		ret = -EINVAL;
916 	}
917 	return ret;
918 }
919 
920 static void usbg_data_write_cmpl(struct usb_ep *ep, struct usb_request *req)
921 {
922 	struct usbg_cmd *cmd = req->context;
923 	struct se_cmd *se_cmd = &cmd->se_cmd;
924 
925 	if (req->status < 0) {
926 		pr_err("%s() state %d transfer failed\n", __func__, cmd->state);
927 		goto cleanup;
928 	}
929 
930 	if (req->num_sgs == 0) {
931 		sg_copy_from_buffer(se_cmd->t_data_sg,
932 				se_cmd->t_data_nents,
933 				cmd->data_buf,
934 				se_cmd->data_length);
935 	}
936 
937 	complete(&cmd->write_complete);
938 	return;
939 
940 cleanup:
941 	target_put_sess_cmd(se_cmd);
942 	transport_generic_free_cmd(&cmd->se_cmd, 0);
943 }
944 
945 static int usbg_prepare_w_request(struct usbg_cmd *cmd, struct usb_request *req)
946 {
947 	struct se_cmd *se_cmd = &cmd->se_cmd;
948 	struct f_uas *fu = cmd->fu;
949 	struct usb_gadget *gadget = fuas_to_gadget(fu);
950 
951 	if (!gadget->sg_supported) {
952 		cmd->data_buf = kmalloc(se_cmd->data_length, GFP_ATOMIC);
953 		if (!cmd->data_buf)
954 			return -ENOMEM;
955 
956 		req->buf = cmd->data_buf;
957 	} else {
958 		req->buf = NULL;
959 		req->num_sgs = se_cmd->t_data_nents;
960 		req->sg = se_cmd->t_data_sg;
961 	}
962 
963 	req->is_last = 1;
964 	req->stream_id = cmd->tag;
965 	req->complete = usbg_data_write_cmpl;
966 	req->length = se_cmd->data_length;
967 	req->context = cmd;
968 	return 0;
969 }
970 
971 static int usbg_send_status_response(struct se_cmd *se_cmd)
972 {
973 	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
974 			se_cmd);
975 	struct f_uas *fu = cmd->fu;
976 
977 	if (fu->flags & USBG_IS_BOT)
978 		return bot_send_status_response(cmd);
979 	else
980 		return uasp_send_status_response(cmd);
981 }
982 
983 static int usbg_send_write_request(struct se_cmd *se_cmd)
984 {
985 	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
986 			se_cmd);
987 	struct f_uas *fu = cmd->fu;
988 
989 	if (fu->flags & USBG_IS_BOT)
990 		return bot_send_write_request(cmd);
991 	else
992 		return uasp_send_write_request(cmd);
993 }
994 
995 static int usbg_send_read_response(struct se_cmd *se_cmd)
996 {
997 	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
998 			se_cmd);
999 	struct f_uas *fu = cmd->fu;
1000 
1001 	if (fu->flags & USBG_IS_BOT)
1002 		return bot_send_read_response(cmd);
1003 	else
1004 		return uasp_send_read_response(cmd);
1005 }
1006 
1007 static void usbg_cmd_work(struct work_struct *work)
1008 {
1009 	struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1010 	struct se_cmd *se_cmd;
1011 	struct tcm_usbg_nexus *tv_nexus;
1012 	struct usbg_tpg *tpg;
1013 	int dir, flags = (TARGET_SCF_UNKNOWN_SIZE | TARGET_SCF_ACK_KREF);
1014 
1015 	se_cmd = &cmd->se_cmd;
1016 	tpg = cmd->fu->tpg;
1017 	tv_nexus = tpg->tpg_nexus;
1018 	dir = get_cmd_dir(cmd->cmd_buf);
1019 	if (dir < 0) {
1020 		__target_init_cmd(se_cmd,
1021 				  tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1022 				  tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1023 				  cmd->prio_attr, cmd->sense_iu.sense,
1024 				  cmd->unpacked_lun, NULL);
1025 		goto out;
1026 	}
1027 
1028 	target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess, cmd->cmd_buf,
1029 			  cmd->sense_iu.sense, cmd->unpacked_lun, 0,
1030 			  cmd->prio_attr, dir, flags);
1031 	return;
1032 
1033 out:
1034 	transport_send_check_condition_and_sense(se_cmd,
1035 			TCM_UNSUPPORTED_SCSI_OPCODE, 0);
1036 }
1037 
1038 static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu,
1039 		struct tcm_usbg_nexus *tv_nexus, u32 scsi_tag)
1040 {
1041 	struct se_session *se_sess = tv_nexus->tvn_se_sess;
1042 	struct usbg_cmd *cmd;
1043 	int tag, cpu;
1044 
1045 	tag = sbitmap_queue_get(&se_sess->sess_tag_pool, &cpu);
1046 	if (tag < 0)
1047 		return ERR_PTR(-ENOMEM);
1048 
1049 	cmd = &((struct usbg_cmd *)se_sess->sess_cmd_map)[tag];
1050 	memset(cmd, 0, sizeof(*cmd));
1051 	cmd->se_cmd.map_tag = tag;
1052 	cmd->se_cmd.map_cpu = cpu;
1053 	cmd->se_cmd.tag = cmd->tag = scsi_tag;
1054 	cmd->fu = fu;
1055 
1056 	return cmd;
1057 }
1058 
1059 static void usbg_release_cmd(struct se_cmd *);
1060 
1061 static int usbg_submit_command(struct f_uas *fu, struct usb_request *req)
1062 {
1063 	struct command_iu *cmd_iu = req->buf;
1064 	struct usbg_cmd *cmd;
1065 	struct usbg_tpg *tpg = fu->tpg;
1066 	struct tcm_usbg_nexus *tv_nexus;
1067 	u32 cmd_len;
1068 	u16 scsi_tag;
1069 
1070 	if (cmd_iu->iu_id != IU_ID_COMMAND) {
1071 		pr_err("Unsupported type %d\n", cmd_iu->iu_id);
1072 		return -EINVAL;
1073 	}
1074 
1075 	tv_nexus = tpg->tpg_nexus;
1076 	if (!tv_nexus) {
1077 		pr_err("Missing nexus, ignoring command\n");
1078 		return -EINVAL;
1079 	}
1080 
1081 	cmd_len = (cmd_iu->len & ~0x3) + 16;
1082 	if (cmd_len > USBG_MAX_CMD)
1083 		return -EINVAL;
1084 
1085 	scsi_tag = be16_to_cpup(&cmd_iu->tag);
1086 	cmd = usbg_get_cmd(fu, tv_nexus, scsi_tag);
1087 	if (IS_ERR(cmd)) {
1088 		pr_err("usbg_get_cmd failed\n");
1089 		return -ENOMEM;
1090 	}
1091 	memcpy(cmd->cmd_buf, cmd_iu->cdb, cmd_len);
1092 
1093 	switch (cmd_iu->prio_attr & 0x7) {
1094 	case UAS_HEAD_TAG:
1095 		cmd->prio_attr = TCM_HEAD_TAG;
1096 		break;
1097 	case UAS_ORDERED_TAG:
1098 		cmd->prio_attr = TCM_ORDERED_TAG;
1099 		break;
1100 	case UAS_ACA:
1101 		cmd->prio_attr = TCM_ACA_TAG;
1102 		break;
1103 	default:
1104 		pr_debug_once("Unsupported prio_attr: %02x.\n",
1105 				cmd_iu->prio_attr);
1106 		fallthrough;
1107 	case UAS_SIMPLE_TAG:
1108 		cmd->prio_attr = TCM_SIMPLE_TAG;
1109 		break;
1110 	}
1111 
1112 	cmd->unpacked_lun = scsilun_to_int(&cmd_iu->lun);
1113 	cmd->req = req;
1114 
1115 	INIT_WORK(&cmd->work, usbg_cmd_work);
1116 	queue_work(tpg->workqueue, &cmd->work);
1117 
1118 	return 0;
1119 }
1120 
1121 static void bot_cmd_work(struct work_struct *work)
1122 {
1123 	struct usbg_cmd *cmd = container_of(work, struct usbg_cmd, work);
1124 	struct se_cmd *se_cmd;
1125 	struct tcm_usbg_nexus *tv_nexus;
1126 	struct usbg_tpg *tpg;
1127 	int dir;
1128 
1129 	se_cmd = &cmd->se_cmd;
1130 	tpg = cmd->fu->tpg;
1131 	tv_nexus = tpg->tpg_nexus;
1132 	dir = get_cmd_dir(cmd->cmd_buf);
1133 	if (dir < 0) {
1134 		__target_init_cmd(se_cmd,
1135 				  tv_nexus->tvn_se_sess->se_tpg->se_tpg_tfo,
1136 				  tv_nexus->tvn_se_sess, cmd->data_len, DMA_NONE,
1137 				  cmd->prio_attr, cmd->sense_iu.sense,
1138 				  cmd->unpacked_lun, NULL);
1139 		goto out;
1140 	}
1141 
1142 	target_submit_cmd(se_cmd, tv_nexus->tvn_se_sess,
1143 			  cmd->cmd_buf, cmd->sense_iu.sense, cmd->unpacked_lun,
1144 			  cmd->data_len, cmd->prio_attr, dir, 0);
1145 	return;
1146 
1147 out:
1148 	transport_send_check_condition_and_sense(se_cmd,
1149 				TCM_UNSUPPORTED_SCSI_OPCODE, 0);
1150 }
1151 
1152 static int bot_submit_command(struct f_uas *fu,
1153 		void *cmdbuf, unsigned int len)
1154 {
1155 	struct bulk_cb_wrap *cbw = cmdbuf;
1156 	struct usbg_cmd *cmd;
1157 	struct usbg_tpg *tpg = fu->tpg;
1158 	struct tcm_usbg_nexus *tv_nexus;
1159 	u32 cmd_len;
1160 
1161 	if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) {
1162 		pr_err("Wrong signature on CBW\n");
1163 		return -EINVAL;
1164 	}
1165 	if (len != 31) {
1166 		pr_err("Wrong length for CBW\n");
1167 		return -EINVAL;
1168 	}
1169 
1170 	cmd_len = cbw->Length;
1171 	if (cmd_len < 1 || cmd_len > 16)
1172 		return -EINVAL;
1173 
1174 	tv_nexus = tpg->tpg_nexus;
1175 	if (!tv_nexus) {
1176 		pr_err("Missing nexus, ignoring command\n");
1177 		return -ENODEV;
1178 	}
1179 
1180 	cmd = usbg_get_cmd(fu, tv_nexus, cbw->Tag);
1181 	if (IS_ERR(cmd)) {
1182 		pr_err("usbg_get_cmd failed\n");
1183 		return -ENOMEM;
1184 	}
1185 	memcpy(cmd->cmd_buf, cbw->CDB, cmd_len);
1186 
1187 	cmd->bot_tag = cbw->Tag;
1188 	cmd->prio_attr = TCM_SIMPLE_TAG;
1189 	cmd->unpacked_lun = cbw->Lun;
1190 	cmd->is_read = cbw->Flags & US_BULK_FLAG_IN ? 1 : 0;
1191 	cmd->data_len = le32_to_cpu(cbw->DataTransferLength);
1192 	cmd->se_cmd.tag = le32_to_cpu(cmd->bot_tag);
1193 
1194 	INIT_WORK(&cmd->work, bot_cmd_work);
1195 	queue_work(tpg->workqueue, &cmd->work);
1196 
1197 	return 0;
1198 }
1199 
1200 /* Start fabric.c code */
1201 
1202 static int usbg_check_true(struct se_portal_group *se_tpg)
1203 {
1204 	return 1;
1205 }
1206 
1207 static char *usbg_get_fabric_wwn(struct se_portal_group *se_tpg)
1208 {
1209 	struct usbg_tpg *tpg = container_of(se_tpg,
1210 				struct usbg_tpg, se_tpg);
1211 	struct usbg_tport *tport = tpg->tport;
1212 
1213 	return &tport->tport_name[0];
1214 }
1215 
1216 static u16 usbg_get_tag(struct se_portal_group *se_tpg)
1217 {
1218 	struct usbg_tpg *tpg = container_of(se_tpg,
1219 				struct usbg_tpg, se_tpg);
1220 	return tpg->tport_tpgt;
1221 }
1222 
1223 static void usbg_release_cmd(struct se_cmd *se_cmd)
1224 {
1225 	struct usbg_cmd *cmd = container_of(se_cmd, struct usbg_cmd,
1226 			se_cmd);
1227 	struct se_session *se_sess = se_cmd->se_sess;
1228 
1229 	kfree(cmd->data_buf);
1230 	target_free_tag(se_sess, se_cmd);
1231 }
1232 
1233 static void usbg_queue_tm_rsp(struct se_cmd *se_cmd)
1234 {
1235 }
1236 
1237 static void usbg_aborted_task(struct se_cmd *se_cmd)
1238 {
1239 }
1240 
1241 static const char *usbg_check_wwn(const char *name)
1242 {
1243 	const char *n;
1244 	unsigned int len;
1245 
1246 	n = strstr(name, "naa.");
1247 	if (!n)
1248 		return NULL;
1249 	n += 4;
1250 	len = strlen(n);
1251 	if (len == 0 || len > USBG_NAMELEN - 1)
1252 		return NULL;
1253 	return n;
1254 }
1255 
1256 static int usbg_init_nodeacl(struct se_node_acl *se_nacl, const char *name)
1257 {
1258 	if (!usbg_check_wwn(name))
1259 		return -EINVAL;
1260 	return 0;
1261 }
1262 
1263 static struct se_portal_group *usbg_make_tpg(struct se_wwn *wwn,
1264 					     const char *name)
1265 {
1266 	struct usbg_tport *tport = container_of(wwn, struct usbg_tport,
1267 			tport_wwn);
1268 	struct usbg_tpg *tpg;
1269 	unsigned long tpgt;
1270 	int ret;
1271 	struct f_tcm_opts *opts;
1272 	unsigned i;
1273 
1274 	if (strstr(name, "tpgt_") != name)
1275 		return ERR_PTR(-EINVAL);
1276 	if (kstrtoul(name + 5, 0, &tpgt) || tpgt > UINT_MAX)
1277 		return ERR_PTR(-EINVAL);
1278 	ret = -ENODEV;
1279 	mutex_lock(&tpg_instances_lock);
1280 	for (i = 0; i < TPG_INSTANCES; ++i)
1281 		if (tpg_instances[i].func_inst && !tpg_instances[i].tpg)
1282 			break;
1283 	if (i == TPG_INSTANCES)
1284 		goto unlock_inst;
1285 
1286 	opts = container_of(tpg_instances[i].func_inst, struct f_tcm_opts,
1287 		func_inst);
1288 	mutex_lock(&opts->dep_lock);
1289 	if (!opts->ready)
1290 		goto unlock_dep;
1291 
1292 	if (opts->has_dep) {
1293 		if (!try_module_get(opts->dependent))
1294 			goto unlock_dep;
1295 	} else {
1296 		ret = configfs_depend_item_unlocked(
1297 			wwn->wwn_group.cg_subsys,
1298 			&opts->func_inst.group.cg_item);
1299 		if (ret)
1300 			goto unlock_dep;
1301 	}
1302 
1303 	tpg = kzalloc(sizeof(struct usbg_tpg), GFP_KERNEL);
1304 	ret = -ENOMEM;
1305 	if (!tpg)
1306 		goto unref_dep;
1307 	mutex_init(&tpg->tpg_mutex);
1308 	atomic_set(&tpg->tpg_port_count, 0);
1309 	tpg->workqueue = alloc_workqueue("tcm_usb_gadget",
1310 					 WQ_UNBOUND, WQ_UNBOUND_MAX_ACTIVE);
1311 	if (!tpg->workqueue)
1312 		goto free_tpg;
1313 
1314 	tpg->tport = tport;
1315 	tpg->tport_tpgt = tpgt;
1316 
1317 	/*
1318 	 * SPC doesn't assign a protocol identifier for USB-SCSI, so we
1319 	 * pretend to be SAS..
1320 	 */
1321 	ret = core_tpg_register(wwn, &tpg->se_tpg, SCSI_PROTOCOL_SAS);
1322 	if (ret < 0)
1323 		goto free_workqueue;
1324 
1325 	tpg_instances[i].tpg = tpg;
1326 	tpg->fi = tpg_instances[i].func_inst;
1327 	mutex_unlock(&opts->dep_lock);
1328 	mutex_unlock(&tpg_instances_lock);
1329 	return &tpg->se_tpg;
1330 
1331 free_workqueue:
1332 	destroy_workqueue(tpg->workqueue);
1333 free_tpg:
1334 	kfree(tpg);
1335 unref_dep:
1336 	if (opts->has_dep)
1337 		module_put(opts->dependent);
1338 	else
1339 		configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
1340 unlock_dep:
1341 	mutex_unlock(&opts->dep_lock);
1342 unlock_inst:
1343 	mutex_unlock(&tpg_instances_lock);
1344 
1345 	return ERR_PTR(ret);
1346 }
1347 
1348 static int tcm_usbg_drop_nexus(struct usbg_tpg *);
1349 
1350 static void usbg_drop_tpg(struct se_portal_group *se_tpg)
1351 {
1352 	struct usbg_tpg *tpg = container_of(se_tpg,
1353 				struct usbg_tpg, se_tpg);
1354 	unsigned i;
1355 	struct f_tcm_opts *opts;
1356 
1357 	tcm_usbg_drop_nexus(tpg);
1358 	core_tpg_deregister(se_tpg);
1359 	destroy_workqueue(tpg->workqueue);
1360 
1361 	mutex_lock(&tpg_instances_lock);
1362 	for (i = 0; i < TPG_INSTANCES; ++i)
1363 		if (tpg_instances[i].tpg == tpg)
1364 			break;
1365 	if (i < TPG_INSTANCES) {
1366 		tpg_instances[i].tpg = NULL;
1367 		opts = container_of(tpg_instances[i].func_inst,
1368 			struct f_tcm_opts, func_inst);
1369 		mutex_lock(&opts->dep_lock);
1370 		if (opts->has_dep)
1371 			module_put(opts->dependent);
1372 		else
1373 			configfs_undepend_item_unlocked(
1374 				&opts->func_inst.group.cg_item);
1375 		mutex_unlock(&opts->dep_lock);
1376 	}
1377 	mutex_unlock(&tpg_instances_lock);
1378 
1379 	kfree(tpg);
1380 }
1381 
1382 static struct se_wwn *usbg_make_tport(
1383 	struct target_fabric_configfs *tf,
1384 	struct config_group *group,
1385 	const char *name)
1386 {
1387 	struct usbg_tport *tport;
1388 	const char *wnn_name;
1389 	u64 wwpn = 0;
1390 
1391 	wnn_name = usbg_check_wwn(name);
1392 	if (!wnn_name)
1393 		return ERR_PTR(-EINVAL);
1394 
1395 	tport = kzalloc(sizeof(struct usbg_tport), GFP_KERNEL);
1396 	if (!(tport))
1397 		return ERR_PTR(-ENOMEM);
1398 
1399 	tport->tport_wwpn = wwpn;
1400 	snprintf(tport->tport_name, sizeof(tport->tport_name), "%s", wnn_name);
1401 	return &tport->tport_wwn;
1402 }
1403 
1404 static void usbg_drop_tport(struct se_wwn *wwn)
1405 {
1406 	struct usbg_tport *tport = container_of(wwn,
1407 				struct usbg_tport, tport_wwn);
1408 	kfree(tport);
1409 }
1410 
1411 /*
1412  * If somebody feels like dropping the version property, go ahead.
1413  */
1414 static ssize_t usbg_wwn_version_show(struct config_item *item,  char *page)
1415 {
1416 	return sprintf(page, "usb-gadget fabric module\n");
1417 }
1418 
1419 CONFIGFS_ATTR_RO(usbg_wwn_, version);
1420 
1421 static struct configfs_attribute *usbg_wwn_attrs[] = {
1422 	&usbg_wwn_attr_version,
1423 	NULL,
1424 };
1425 
1426 static int usbg_attach(struct usbg_tpg *);
1427 static void usbg_detach(struct usbg_tpg *);
1428 
1429 static int usbg_enable_tpg(struct se_portal_group *se_tpg, bool enable)
1430 {
1431 	struct usbg_tpg  *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1432 	int ret = 0;
1433 
1434 	if (enable)
1435 		ret = usbg_attach(tpg);
1436 	else
1437 		usbg_detach(tpg);
1438 	if (ret)
1439 		return ret;
1440 
1441 	tpg->gadget_connect = enable;
1442 
1443 	return 0;
1444 }
1445 
1446 static ssize_t tcm_usbg_tpg_nexus_show(struct config_item *item, char *page)
1447 {
1448 	struct se_portal_group *se_tpg = to_tpg(item);
1449 	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1450 	struct tcm_usbg_nexus *tv_nexus;
1451 	ssize_t ret;
1452 
1453 	mutex_lock(&tpg->tpg_mutex);
1454 	tv_nexus = tpg->tpg_nexus;
1455 	if (!tv_nexus) {
1456 		ret = -ENODEV;
1457 		goto out;
1458 	}
1459 	ret = sysfs_emit(page, "%s\n",
1460 			 tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1461 out:
1462 	mutex_unlock(&tpg->tpg_mutex);
1463 	return ret;
1464 }
1465 
1466 static int usbg_alloc_sess_cb(struct se_portal_group *se_tpg,
1467 			      struct se_session *se_sess, void *p)
1468 {
1469 	struct usbg_tpg *tpg = container_of(se_tpg,
1470 				struct usbg_tpg, se_tpg);
1471 
1472 	tpg->tpg_nexus = p;
1473 	return 0;
1474 }
1475 
1476 static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
1477 {
1478 	struct tcm_usbg_nexus *tv_nexus;
1479 	int ret = 0;
1480 
1481 	mutex_lock(&tpg->tpg_mutex);
1482 	if (tpg->tpg_nexus) {
1483 		ret = -EEXIST;
1484 		pr_debug("tpg->tpg_nexus already exists\n");
1485 		goto out_unlock;
1486 	}
1487 
1488 	tv_nexus = kzalloc(sizeof(*tv_nexus), GFP_KERNEL);
1489 	if (!tv_nexus) {
1490 		ret = -ENOMEM;
1491 		goto out_unlock;
1492 	}
1493 
1494 	tv_nexus->tvn_se_sess = target_setup_session(&tpg->se_tpg,
1495 						     USB_G_DEFAULT_SESSION_TAGS,
1496 						     sizeof(struct usbg_cmd),
1497 						     TARGET_PROT_NORMAL, name,
1498 						     tv_nexus, usbg_alloc_sess_cb);
1499 	if (IS_ERR(tv_nexus->tvn_se_sess)) {
1500 #define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n"
1501 		pr_debug(MAKE_NEXUS_MSG, name);
1502 #undef MAKE_NEXUS_MSG
1503 		ret = PTR_ERR(tv_nexus->tvn_se_sess);
1504 		kfree(tv_nexus);
1505 	}
1506 
1507 out_unlock:
1508 	mutex_unlock(&tpg->tpg_mutex);
1509 	return ret;
1510 }
1511 
1512 static int tcm_usbg_drop_nexus(struct usbg_tpg *tpg)
1513 {
1514 	struct se_session *se_sess;
1515 	struct tcm_usbg_nexus *tv_nexus;
1516 	int ret = -ENODEV;
1517 
1518 	mutex_lock(&tpg->tpg_mutex);
1519 	tv_nexus = tpg->tpg_nexus;
1520 	if (!tv_nexus)
1521 		goto out;
1522 
1523 	se_sess = tv_nexus->tvn_se_sess;
1524 	if (!se_sess)
1525 		goto out;
1526 
1527 	if (atomic_read(&tpg->tpg_port_count)) {
1528 		ret = -EPERM;
1529 #define MSG "Unable to remove Host I_T Nexus with active TPG port count: %d\n"
1530 		pr_err(MSG, atomic_read(&tpg->tpg_port_count));
1531 #undef MSG
1532 		goto out;
1533 	}
1534 
1535 	pr_debug("Removing I_T Nexus to Initiator Port: %s\n",
1536 			tv_nexus->tvn_se_sess->se_node_acl->initiatorname);
1537 	/*
1538 	 * Release the SCSI I_T Nexus to the emulated vHost Target Port
1539 	 */
1540 	target_remove_session(se_sess);
1541 	tpg->tpg_nexus = NULL;
1542 
1543 	kfree(tv_nexus);
1544 	ret = 0;
1545 out:
1546 	mutex_unlock(&tpg->tpg_mutex);
1547 	return ret;
1548 }
1549 
1550 static ssize_t tcm_usbg_tpg_nexus_store(struct config_item *item,
1551 		const char *page, size_t count)
1552 {
1553 	struct se_portal_group *se_tpg = to_tpg(item);
1554 	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1555 	unsigned char i_port[USBG_NAMELEN], *ptr;
1556 	int ret;
1557 
1558 	if (!strncmp(page, "NULL", 4)) {
1559 		ret = tcm_usbg_drop_nexus(tpg);
1560 		return (!ret) ? count : ret;
1561 	}
1562 	if (strlen(page) >= USBG_NAMELEN) {
1563 
1564 #define NEXUS_STORE_MSG "Emulated NAA Sas Address: %s, exceeds max: %d\n"
1565 		pr_err(NEXUS_STORE_MSG, page, USBG_NAMELEN);
1566 #undef NEXUS_STORE_MSG
1567 		return -EINVAL;
1568 	}
1569 	snprintf(i_port, USBG_NAMELEN, "%s", page);
1570 
1571 	ptr = strstr(i_port, "naa.");
1572 	if (!ptr) {
1573 		pr_err("Missing 'naa.' prefix\n");
1574 		return -EINVAL;
1575 	}
1576 
1577 	if (i_port[strlen(i_port) - 1] == '\n')
1578 		i_port[strlen(i_port) - 1] = '\0';
1579 
1580 	ret = tcm_usbg_make_nexus(tpg, &i_port[0]);
1581 	if (ret < 0)
1582 		return ret;
1583 	return count;
1584 }
1585 
1586 CONFIGFS_ATTR(tcm_usbg_tpg_, nexus);
1587 
1588 static struct configfs_attribute *usbg_base_attrs[] = {
1589 	&tcm_usbg_tpg_attr_nexus,
1590 	NULL,
1591 };
1592 
1593 static int usbg_port_link(struct se_portal_group *se_tpg, struct se_lun *lun)
1594 {
1595 	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1596 
1597 	atomic_inc(&tpg->tpg_port_count);
1598 	smp_mb__after_atomic();
1599 	return 0;
1600 }
1601 
1602 static void usbg_port_unlink(struct se_portal_group *se_tpg,
1603 		struct se_lun *se_lun)
1604 {
1605 	struct usbg_tpg *tpg = container_of(se_tpg, struct usbg_tpg, se_tpg);
1606 
1607 	atomic_dec(&tpg->tpg_port_count);
1608 	smp_mb__after_atomic();
1609 }
1610 
1611 static int usbg_check_stop_free(struct se_cmd *se_cmd)
1612 {
1613 	return target_put_sess_cmd(se_cmd);
1614 }
1615 
1616 static const struct target_core_fabric_ops usbg_ops = {
1617 	.module				= THIS_MODULE,
1618 	.fabric_name			= "usb_gadget",
1619 	.tpg_get_wwn			= usbg_get_fabric_wwn,
1620 	.tpg_get_tag			= usbg_get_tag,
1621 	.tpg_check_demo_mode		= usbg_check_true,
1622 	.release_cmd			= usbg_release_cmd,
1623 	.sess_get_initiator_sid		= NULL,
1624 	.write_pending			= usbg_send_write_request,
1625 	.queue_data_in			= usbg_send_read_response,
1626 	.queue_status			= usbg_send_status_response,
1627 	.queue_tm_rsp			= usbg_queue_tm_rsp,
1628 	.aborted_task			= usbg_aborted_task,
1629 	.check_stop_free		= usbg_check_stop_free,
1630 
1631 	.fabric_make_wwn		= usbg_make_tport,
1632 	.fabric_drop_wwn		= usbg_drop_tport,
1633 	.fabric_make_tpg		= usbg_make_tpg,
1634 	.fabric_enable_tpg		= usbg_enable_tpg,
1635 	.fabric_drop_tpg		= usbg_drop_tpg,
1636 	.fabric_post_link		= usbg_port_link,
1637 	.fabric_pre_unlink		= usbg_port_unlink,
1638 	.fabric_init_nodeacl		= usbg_init_nodeacl,
1639 
1640 	.tfc_wwn_attrs			= usbg_wwn_attrs,
1641 	.tfc_tpg_base_attrs		= usbg_base_attrs,
1642 
1643 	.default_submit_type		= TARGET_DIRECT_SUBMIT,
1644 	.direct_submit_supp		= 1,
1645 };
1646 
1647 /* Start gadget.c code */
1648 
1649 static struct usb_interface_descriptor bot_intf_desc = {
1650 	.bLength =              sizeof(bot_intf_desc),
1651 	.bDescriptorType =      USB_DT_INTERFACE,
1652 	.bNumEndpoints =        2,
1653 	.bAlternateSetting =	USB_G_ALT_INT_BBB,
1654 	.bInterfaceClass =      USB_CLASS_MASS_STORAGE,
1655 	.bInterfaceSubClass =   USB_SC_SCSI,
1656 	.bInterfaceProtocol =   USB_PR_BULK,
1657 };
1658 
1659 static struct usb_interface_descriptor uasp_intf_desc = {
1660 	.bLength =		sizeof(uasp_intf_desc),
1661 	.bDescriptorType =	USB_DT_INTERFACE,
1662 	.bNumEndpoints =	4,
1663 	.bAlternateSetting =	USB_G_ALT_INT_UAS,
1664 	.bInterfaceClass =	USB_CLASS_MASS_STORAGE,
1665 	.bInterfaceSubClass =	USB_SC_SCSI,
1666 	.bInterfaceProtocol =	USB_PR_UAS,
1667 };
1668 
1669 static struct usb_endpoint_descriptor uasp_bi_desc = {
1670 	.bLength =		USB_DT_ENDPOINT_SIZE,
1671 	.bDescriptorType =	USB_DT_ENDPOINT,
1672 	.bEndpointAddress =	USB_DIR_IN,
1673 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1674 	.wMaxPacketSize =	cpu_to_le16(512),
1675 };
1676 
1677 static struct usb_endpoint_descriptor uasp_fs_bi_desc = {
1678 	.bLength =		USB_DT_ENDPOINT_SIZE,
1679 	.bDescriptorType =	USB_DT_ENDPOINT,
1680 	.bEndpointAddress =	USB_DIR_IN,
1681 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1682 };
1683 
1684 static struct usb_pipe_usage_descriptor uasp_bi_pipe_desc = {
1685 	.bLength =		sizeof(uasp_bi_pipe_desc),
1686 	.bDescriptorType =	USB_DT_PIPE_USAGE,
1687 	.bPipeID =		DATA_IN_PIPE_ID,
1688 };
1689 
1690 static struct usb_endpoint_descriptor uasp_ss_bi_desc = {
1691 	.bLength =		USB_DT_ENDPOINT_SIZE,
1692 	.bDescriptorType =	USB_DT_ENDPOINT,
1693 	.bEndpointAddress =	USB_DIR_IN,
1694 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1695 	.wMaxPacketSize =	cpu_to_le16(1024),
1696 };
1697 
1698 static struct usb_ss_ep_comp_descriptor uasp_bi_ep_comp_desc = {
1699 	.bLength =		sizeof(uasp_bi_ep_comp_desc),
1700 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1701 	.bMaxBurst =		15,
1702 	.bmAttributes =		UASP_SS_EP_COMP_LOG_STREAMS,
1703 	.wBytesPerInterval =	0,
1704 };
1705 
1706 static struct usb_ss_ep_comp_descriptor bot_bi_ep_comp_desc = {
1707 	.bLength =		sizeof(bot_bi_ep_comp_desc),
1708 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1709 	.bMaxBurst =		15,
1710 };
1711 
1712 static struct usb_endpoint_descriptor uasp_bo_desc = {
1713 	.bLength =		USB_DT_ENDPOINT_SIZE,
1714 	.bDescriptorType =	USB_DT_ENDPOINT,
1715 	.bEndpointAddress =	USB_DIR_OUT,
1716 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1717 	.wMaxPacketSize =	cpu_to_le16(512),
1718 };
1719 
1720 static struct usb_endpoint_descriptor uasp_fs_bo_desc = {
1721 	.bLength =		USB_DT_ENDPOINT_SIZE,
1722 	.bDescriptorType =	USB_DT_ENDPOINT,
1723 	.bEndpointAddress =	USB_DIR_OUT,
1724 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1725 };
1726 
1727 static struct usb_pipe_usage_descriptor uasp_bo_pipe_desc = {
1728 	.bLength =		sizeof(uasp_bo_pipe_desc),
1729 	.bDescriptorType =	USB_DT_PIPE_USAGE,
1730 	.bPipeID =		DATA_OUT_PIPE_ID,
1731 };
1732 
1733 static struct usb_endpoint_descriptor uasp_ss_bo_desc = {
1734 	.bLength =		USB_DT_ENDPOINT_SIZE,
1735 	.bDescriptorType =	USB_DT_ENDPOINT,
1736 	.bEndpointAddress =	USB_DIR_OUT,
1737 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1738 	.wMaxPacketSize =	cpu_to_le16(0x400),
1739 };
1740 
1741 static struct usb_ss_ep_comp_descriptor uasp_bo_ep_comp_desc = {
1742 	.bLength =		sizeof(uasp_bo_ep_comp_desc),
1743 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1744 	.bMaxBurst =		15,
1745 	.bmAttributes =		UASP_SS_EP_COMP_LOG_STREAMS,
1746 };
1747 
1748 static struct usb_ss_ep_comp_descriptor bot_bo_ep_comp_desc = {
1749 	.bLength =		sizeof(bot_bo_ep_comp_desc),
1750 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1751 	.bMaxBurst =		15,
1752 };
1753 
1754 static struct usb_endpoint_descriptor uasp_status_desc = {
1755 	.bLength =		USB_DT_ENDPOINT_SIZE,
1756 	.bDescriptorType =	USB_DT_ENDPOINT,
1757 	.bEndpointAddress =	USB_DIR_IN,
1758 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1759 	.wMaxPacketSize =	cpu_to_le16(512),
1760 };
1761 
1762 static struct usb_endpoint_descriptor uasp_fs_status_desc = {
1763 	.bLength =		USB_DT_ENDPOINT_SIZE,
1764 	.bDescriptorType =	USB_DT_ENDPOINT,
1765 	.bEndpointAddress =	USB_DIR_IN,
1766 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1767 };
1768 
1769 static struct usb_pipe_usage_descriptor uasp_status_pipe_desc = {
1770 	.bLength =		sizeof(uasp_status_pipe_desc),
1771 	.bDescriptorType =	USB_DT_PIPE_USAGE,
1772 	.bPipeID =		STATUS_PIPE_ID,
1773 };
1774 
1775 static struct usb_endpoint_descriptor uasp_ss_status_desc = {
1776 	.bLength =		USB_DT_ENDPOINT_SIZE,
1777 	.bDescriptorType =	USB_DT_ENDPOINT,
1778 	.bEndpointAddress =	USB_DIR_IN,
1779 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1780 	.wMaxPacketSize =	cpu_to_le16(1024),
1781 };
1782 
1783 static struct usb_ss_ep_comp_descriptor uasp_status_in_ep_comp_desc = {
1784 	.bLength =		sizeof(uasp_status_in_ep_comp_desc),
1785 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1786 	.bmAttributes =		UASP_SS_EP_COMP_LOG_STREAMS,
1787 };
1788 
1789 static struct usb_endpoint_descriptor uasp_cmd_desc = {
1790 	.bLength =		USB_DT_ENDPOINT_SIZE,
1791 	.bDescriptorType =	USB_DT_ENDPOINT,
1792 	.bEndpointAddress =	USB_DIR_OUT,
1793 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1794 	.wMaxPacketSize =	cpu_to_le16(512),
1795 };
1796 
1797 static struct usb_endpoint_descriptor uasp_fs_cmd_desc = {
1798 	.bLength =		USB_DT_ENDPOINT_SIZE,
1799 	.bDescriptorType =	USB_DT_ENDPOINT,
1800 	.bEndpointAddress =	USB_DIR_OUT,
1801 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1802 };
1803 
1804 static struct usb_pipe_usage_descriptor uasp_cmd_pipe_desc = {
1805 	.bLength =		sizeof(uasp_cmd_pipe_desc),
1806 	.bDescriptorType =	USB_DT_PIPE_USAGE,
1807 	.bPipeID =		CMD_PIPE_ID,
1808 };
1809 
1810 static struct usb_endpoint_descriptor uasp_ss_cmd_desc = {
1811 	.bLength =		USB_DT_ENDPOINT_SIZE,
1812 	.bDescriptorType =	USB_DT_ENDPOINT,
1813 	.bEndpointAddress =	USB_DIR_OUT,
1814 	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
1815 	.wMaxPacketSize =	cpu_to_le16(1024),
1816 };
1817 
1818 static struct usb_ss_ep_comp_descriptor uasp_cmd_comp_desc = {
1819 	.bLength =		sizeof(uasp_cmd_comp_desc),
1820 	.bDescriptorType =	USB_DT_SS_ENDPOINT_COMP,
1821 };
1822 
1823 static struct usb_descriptor_header *uasp_fs_function_desc[] = {
1824 	(struct usb_descriptor_header *) &bot_intf_desc,
1825 	(struct usb_descriptor_header *) &uasp_fs_bi_desc,
1826 	(struct usb_descriptor_header *) &uasp_fs_bo_desc,
1827 
1828 	(struct usb_descriptor_header *) &uasp_intf_desc,
1829 	(struct usb_descriptor_header *) &uasp_fs_bi_desc,
1830 	(struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1831 	(struct usb_descriptor_header *) &uasp_fs_bo_desc,
1832 	(struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1833 	(struct usb_descriptor_header *) &uasp_fs_status_desc,
1834 	(struct usb_descriptor_header *) &uasp_status_pipe_desc,
1835 	(struct usb_descriptor_header *) &uasp_fs_cmd_desc,
1836 	(struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1837 	NULL,
1838 };
1839 
1840 static struct usb_descriptor_header *uasp_hs_function_desc[] = {
1841 	(struct usb_descriptor_header *) &bot_intf_desc,
1842 	(struct usb_descriptor_header *) &uasp_bi_desc,
1843 	(struct usb_descriptor_header *) &uasp_bo_desc,
1844 
1845 	(struct usb_descriptor_header *) &uasp_intf_desc,
1846 	(struct usb_descriptor_header *) &uasp_bi_desc,
1847 	(struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1848 	(struct usb_descriptor_header *) &uasp_bo_desc,
1849 	(struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1850 	(struct usb_descriptor_header *) &uasp_status_desc,
1851 	(struct usb_descriptor_header *) &uasp_status_pipe_desc,
1852 	(struct usb_descriptor_header *) &uasp_cmd_desc,
1853 	(struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1854 	NULL,
1855 };
1856 
1857 static struct usb_descriptor_header *uasp_ss_function_desc[] = {
1858 	(struct usb_descriptor_header *) &bot_intf_desc,
1859 	(struct usb_descriptor_header *) &uasp_ss_bi_desc,
1860 	(struct usb_descriptor_header *) &bot_bi_ep_comp_desc,
1861 	(struct usb_descriptor_header *) &uasp_ss_bo_desc,
1862 	(struct usb_descriptor_header *) &bot_bo_ep_comp_desc,
1863 
1864 	(struct usb_descriptor_header *) &uasp_intf_desc,
1865 	(struct usb_descriptor_header *) &uasp_ss_bi_desc,
1866 	(struct usb_descriptor_header *) &uasp_bi_ep_comp_desc,
1867 	(struct usb_descriptor_header *) &uasp_bi_pipe_desc,
1868 	(struct usb_descriptor_header *) &uasp_ss_bo_desc,
1869 	(struct usb_descriptor_header *) &uasp_bo_ep_comp_desc,
1870 	(struct usb_descriptor_header *) &uasp_bo_pipe_desc,
1871 	(struct usb_descriptor_header *) &uasp_ss_status_desc,
1872 	(struct usb_descriptor_header *) &uasp_status_in_ep_comp_desc,
1873 	(struct usb_descriptor_header *) &uasp_status_pipe_desc,
1874 	(struct usb_descriptor_header *) &uasp_ss_cmd_desc,
1875 	(struct usb_descriptor_header *) &uasp_cmd_comp_desc,
1876 	(struct usb_descriptor_header *) &uasp_cmd_pipe_desc,
1877 	NULL,
1878 };
1879 
1880 static struct usb_string	tcm_us_strings[] = {
1881 	[USB_G_STR_INT_UAS].s		= "USB Attached SCSI",
1882 	[USB_G_STR_INT_BBB].s		= "Bulk Only Transport",
1883 	{ },
1884 };
1885 
1886 static struct usb_gadget_strings tcm_stringtab = {
1887 	.language = 0x0409,
1888 	.strings = tcm_us_strings,
1889 };
1890 
1891 static struct usb_gadget_strings *tcm_strings[] = {
1892 	&tcm_stringtab,
1893 	NULL,
1894 };
1895 
1896 static int tcm_bind(struct usb_configuration *c, struct usb_function *f)
1897 {
1898 	struct f_uas		*fu = to_f_uas(f);
1899 	struct usb_string	*us;
1900 	struct usb_gadget	*gadget = c->cdev->gadget;
1901 	struct usb_ep		*ep;
1902 	struct f_tcm_opts	*opts;
1903 	int			iface;
1904 	int			ret;
1905 
1906 	opts = container_of(f->fi, struct f_tcm_opts, func_inst);
1907 
1908 	mutex_lock(&opts->dep_lock);
1909 	if (!opts->can_attach) {
1910 		mutex_unlock(&opts->dep_lock);
1911 		return -ENODEV;
1912 	}
1913 	mutex_unlock(&opts->dep_lock);
1914 	us = usb_gstrings_attach(c->cdev, tcm_strings,
1915 		ARRAY_SIZE(tcm_us_strings));
1916 	if (IS_ERR(us))
1917 		return PTR_ERR(us);
1918 	bot_intf_desc.iInterface = us[USB_G_STR_INT_BBB].id;
1919 	uasp_intf_desc.iInterface = us[USB_G_STR_INT_UAS].id;
1920 
1921 	iface = usb_interface_id(c, f);
1922 	if (iface < 0)
1923 		return iface;
1924 
1925 	bot_intf_desc.bInterfaceNumber = iface;
1926 	uasp_intf_desc.bInterfaceNumber = iface;
1927 	fu->iface = iface;
1928 	ep = usb_ep_autoconfig(gadget, &uasp_fs_bi_desc);
1929 	if (!ep)
1930 		goto ep_fail;
1931 
1932 	fu->ep_in = ep;
1933 
1934 	ep = usb_ep_autoconfig(gadget, &uasp_fs_bo_desc);
1935 	if (!ep)
1936 		goto ep_fail;
1937 	fu->ep_out = ep;
1938 
1939 	ep = usb_ep_autoconfig(gadget, &uasp_fs_status_desc);
1940 	if (!ep)
1941 		goto ep_fail;
1942 	fu->ep_status = ep;
1943 
1944 	ep = usb_ep_autoconfig(gadget, &uasp_fs_cmd_desc);
1945 	if (!ep)
1946 		goto ep_fail;
1947 	fu->ep_cmd = ep;
1948 
1949 	/* Assume endpoint addresses are the same for both speeds */
1950 	uasp_bi_desc.bEndpointAddress =	uasp_fs_bi_desc.bEndpointAddress;
1951 	uasp_bo_desc.bEndpointAddress = uasp_fs_bo_desc.bEndpointAddress;
1952 	uasp_status_desc.bEndpointAddress =
1953 		uasp_fs_status_desc.bEndpointAddress;
1954 	uasp_cmd_desc.bEndpointAddress = uasp_fs_cmd_desc.bEndpointAddress;
1955 
1956 	uasp_ss_bi_desc.bEndpointAddress = uasp_fs_bi_desc.bEndpointAddress;
1957 	uasp_ss_bo_desc.bEndpointAddress = uasp_fs_bo_desc.bEndpointAddress;
1958 	uasp_ss_status_desc.bEndpointAddress =
1959 		uasp_fs_status_desc.bEndpointAddress;
1960 	uasp_ss_cmd_desc.bEndpointAddress = uasp_fs_cmd_desc.bEndpointAddress;
1961 
1962 	ret = usb_assign_descriptors(f, uasp_fs_function_desc,
1963 			uasp_hs_function_desc, uasp_ss_function_desc,
1964 			uasp_ss_function_desc);
1965 	if (ret)
1966 		goto ep_fail;
1967 
1968 	return 0;
1969 ep_fail:
1970 	pr_err("Can't claim all required eps\n");
1971 
1972 	return -ENOTSUPP;
1973 }
1974 
1975 struct guas_setup_wq {
1976 	struct work_struct work;
1977 	struct f_uas *fu;
1978 	unsigned int alt;
1979 };
1980 
1981 static void tcm_delayed_set_alt(struct work_struct *wq)
1982 {
1983 	struct guas_setup_wq *work = container_of(wq, struct guas_setup_wq,
1984 			work);
1985 	struct f_uas *fu = work->fu;
1986 	int alt = work->alt;
1987 
1988 	kfree(work);
1989 
1990 	if (fu->flags & USBG_IS_BOT)
1991 		bot_cleanup_old_alt(fu);
1992 	if (fu->flags & USBG_IS_UAS)
1993 		uasp_cleanup_old_alt(fu);
1994 
1995 	if (alt == USB_G_ALT_INT_BBB)
1996 		bot_set_alt(fu);
1997 	else if (alt == USB_G_ALT_INT_UAS)
1998 		uasp_set_alt(fu);
1999 	usb_composite_setup_continue(fu->function.config->cdev);
2000 }
2001 
2002 static int tcm_get_alt(struct usb_function *f, unsigned intf)
2003 {
2004 	struct f_uas *fu = to_f_uas(f);
2005 
2006 	if (fu->iface != intf)
2007 		return -EOPNOTSUPP;
2008 
2009 	if (fu->flags & USBG_IS_BOT)
2010 		return USB_G_ALT_INT_BBB;
2011 	else if (fu->flags & USBG_IS_UAS)
2012 		return USB_G_ALT_INT_UAS;
2013 
2014 	return -EOPNOTSUPP;
2015 }
2016 
2017 static int tcm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
2018 {
2019 	struct f_uas *fu = to_f_uas(f);
2020 
2021 	if (fu->iface != intf)
2022 		return -EOPNOTSUPP;
2023 
2024 	if ((alt == USB_G_ALT_INT_BBB) || (alt == USB_G_ALT_INT_UAS)) {
2025 		struct guas_setup_wq *work;
2026 
2027 		work = kmalloc(sizeof(*work), GFP_ATOMIC);
2028 		if (!work)
2029 			return -ENOMEM;
2030 		INIT_WORK(&work->work, tcm_delayed_set_alt);
2031 		work->fu = fu;
2032 		work->alt = alt;
2033 		schedule_work(&work->work);
2034 		return USB_GADGET_DELAYED_STATUS;
2035 	}
2036 	return -EOPNOTSUPP;
2037 }
2038 
2039 static void tcm_disable(struct usb_function *f)
2040 {
2041 	struct f_uas *fu = to_f_uas(f);
2042 
2043 	if (fu->flags & USBG_IS_UAS)
2044 		uasp_cleanup_old_alt(fu);
2045 	else if (fu->flags & USBG_IS_BOT)
2046 		bot_cleanup_old_alt(fu);
2047 	fu->flags = 0;
2048 }
2049 
2050 static int tcm_setup(struct usb_function *f,
2051 		const struct usb_ctrlrequest *ctrl)
2052 {
2053 	struct f_uas *fu = to_f_uas(f);
2054 
2055 	if (!(fu->flags & USBG_IS_BOT))
2056 		return -EOPNOTSUPP;
2057 
2058 	return usbg_bot_setup(f, ctrl);
2059 }
2060 
2061 static inline struct f_tcm_opts *to_f_tcm_opts(struct config_item *item)
2062 {
2063 	return container_of(to_config_group(item), struct f_tcm_opts,
2064 		func_inst.group);
2065 }
2066 
2067 static void tcm_attr_release(struct config_item *item)
2068 {
2069 	struct f_tcm_opts *opts = to_f_tcm_opts(item);
2070 
2071 	usb_put_function_instance(&opts->func_inst);
2072 }
2073 
2074 static struct configfs_item_operations tcm_item_ops = {
2075 	.release		= tcm_attr_release,
2076 };
2077 
2078 static const struct config_item_type tcm_func_type = {
2079 	.ct_item_ops	= &tcm_item_ops,
2080 	.ct_owner	= THIS_MODULE,
2081 };
2082 
2083 static void tcm_free_inst(struct usb_function_instance *f)
2084 {
2085 	struct f_tcm_opts *opts;
2086 	unsigned i;
2087 
2088 	opts = container_of(f, struct f_tcm_opts, func_inst);
2089 
2090 	mutex_lock(&tpg_instances_lock);
2091 	for (i = 0; i < TPG_INSTANCES; ++i)
2092 		if (tpg_instances[i].func_inst == f)
2093 			break;
2094 	if (i < TPG_INSTANCES)
2095 		tpg_instances[i].func_inst = NULL;
2096 	mutex_unlock(&tpg_instances_lock);
2097 
2098 	kfree(opts);
2099 }
2100 
2101 static int tcm_register_callback(struct usb_function_instance *f)
2102 {
2103 	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2104 
2105 	mutex_lock(&opts->dep_lock);
2106 	opts->can_attach = true;
2107 	mutex_unlock(&opts->dep_lock);
2108 
2109 	return 0;
2110 }
2111 
2112 static void tcm_unregister_callback(struct usb_function_instance *f)
2113 {
2114 	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2115 
2116 	mutex_lock(&opts->dep_lock);
2117 	unregister_gadget_item(opts->
2118 		func_inst.group.cg_item.ci_parent->ci_parent);
2119 	opts->can_attach = false;
2120 	mutex_unlock(&opts->dep_lock);
2121 }
2122 
2123 static int usbg_attach(struct usbg_tpg *tpg)
2124 {
2125 	struct usb_function_instance *f = tpg->fi;
2126 	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2127 
2128 	if (opts->tcm_register_callback)
2129 		return opts->tcm_register_callback(f);
2130 
2131 	return 0;
2132 }
2133 
2134 static void usbg_detach(struct usbg_tpg *tpg)
2135 {
2136 	struct usb_function_instance *f = tpg->fi;
2137 	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2138 
2139 	if (opts->tcm_unregister_callback)
2140 		opts->tcm_unregister_callback(f);
2141 }
2142 
2143 static int tcm_set_name(struct usb_function_instance *f, const char *name)
2144 {
2145 	struct f_tcm_opts *opts = container_of(f, struct f_tcm_opts, func_inst);
2146 
2147 	pr_debug("tcm: Activating %s\n", name);
2148 
2149 	mutex_lock(&opts->dep_lock);
2150 	opts->ready = true;
2151 	mutex_unlock(&opts->dep_lock);
2152 
2153 	return 0;
2154 }
2155 
2156 static struct usb_function_instance *tcm_alloc_inst(void)
2157 {
2158 	struct f_tcm_opts *opts;
2159 	int i;
2160 
2161 
2162 	opts = kzalloc(sizeof(*opts), GFP_KERNEL);
2163 	if (!opts)
2164 		return ERR_PTR(-ENOMEM);
2165 
2166 	mutex_lock(&tpg_instances_lock);
2167 	for (i = 0; i < TPG_INSTANCES; ++i)
2168 		if (!tpg_instances[i].func_inst)
2169 			break;
2170 
2171 	if (i == TPG_INSTANCES) {
2172 		mutex_unlock(&tpg_instances_lock);
2173 		kfree(opts);
2174 		return ERR_PTR(-EBUSY);
2175 	}
2176 	tpg_instances[i].func_inst = &opts->func_inst;
2177 	mutex_unlock(&tpg_instances_lock);
2178 
2179 	mutex_init(&opts->dep_lock);
2180 	opts->func_inst.set_inst_name = tcm_set_name;
2181 	opts->func_inst.free_func_inst = tcm_free_inst;
2182 	opts->tcm_register_callback = tcm_register_callback;
2183 	opts->tcm_unregister_callback = tcm_unregister_callback;
2184 
2185 	config_group_init_type_name(&opts->func_inst.group, "",
2186 			&tcm_func_type);
2187 
2188 	return &opts->func_inst;
2189 }
2190 
2191 static void tcm_free(struct usb_function *f)
2192 {
2193 	struct f_uas *tcm = to_f_uas(f);
2194 
2195 	kfree(tcm);
2196 }
2197 
2198 static void tcm_unbind(struct usb_configuration *c, struct usb_function *f)
2199 {
2200 	usb_free_all_descriptors(f);
2201 }
2202 
2203 static struct usb_function *tcm_alloc(struct usb_function_instance *fi)
2204 {
2205 	struct f_uas *fu;
2206 	unsigned i;
2207 
2208 	mutex_lock(&tpg_instances_lock);
2209 	for (i = 0; i < TPG_INSTANCES; ++i)
2210 		if (tpg_instances[i].func_inst == fi)
2211 			break;
2212 	if (i == TPG_INSTANCES) {
2213 		mutex_unlock(&tpg_instances_lock);
2214 		return ERR_PTR(-ENODEV);
2215 	}
2216 
2217 	fu = kzalloc(sizeof(*fu), GFP_KERNEL);
2218 	if (!fu) {
2219 		mutex_unlock(&tpg_instances_lock);
2220 		return ERR_PTR(-ENOMEM);
2221 	}
2222 
2223 	fu->function.name = "Target Function";
2224 	fu->function.bind = tcm_bind;
2225 	fu->function.unbind = tcm_unbind;
2226 	fu->function.set_alt = tcm_set_alt;
2227 	fu->function.get_alt = tcm_get_alt;
2228 	fu->function.setup = tcm_setup;
2229 	fu->function.disable = tcm_disable;
2230 	fu->function.free_func = tcm_free;
2231 	fu->tpg = tpg_instances[i].tpg;
2232 	mutex_unlock(&tpg_instances_lock);
2233 
2234 	return &fu->function;
2235 }
2236 
2237 DECLARE_USB_FUNCTION(tcm, tcm_alloc_inst, tcm_alloc);
2238 
2239 static int __init tcm_init(void)
2240 {
2241 	int ret;
2242 
2243 	ret = usb_function_register(&tcmusb_func);
2244 	if (ret)
2245 		return ret;
2246 
2247 	ret = target_register_template(&usbg_ops);
2248 	if (ret)
2249 		usb_function_unregister(&tcmusb_func);
2250 
2251 	return ret;
2252 }
2253 module_init(tcm_init);
2254 
2255 static void __exit tcm_exit(void)
2256 {
2257 	target_unregister_template(&usbg_ops);
2258 	usb_function_unregister(&tcmusb_func);
2259 }
2260 module_exit(tcm_exit);
2261 
2262 MODULE_DESCRIPTION("Target based USB-Gadget");
2263 MODULE_LICENSE("GPL");
2264 MODULE_AUTHOR("Sebastian Andrzej Siewior");
2265